6094215f3978ad2f20b20fc27781b87921efe6710c2a33834c43108dd2d29685

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:45

Target

2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe
Size

39KB
MD5

c7370437e1a8f07e8460d6aca0028163
SHA1

32970bb3d678142edd87d8c4e8bc43cb7d75c96c
SHA256

6094215f3978ad2f20b20fc27781b87921efe6710c2a33834c43108dd2d29685
SHA512

2c779e16b63de6e63c1829e53c5b5d516cddef894e168361f8562eee939d699c056d6b56ce1bf73f4f259cc1e8d2514d7dce4c330493bb48df1efcd107e31af3
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuDbj:ZzFbxmLPWQMOtEvwDpjLeJAsKcbj

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2556 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe

pid process

2248 2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2556	misid.exe

pid	process
2248	2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe

description	pid	process	target process
PID 2248 wrote to memory of 2556	2248	2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe	misid.exe
PID 2248 wrote to memory of 2556	2248	2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe	misid.exe
PID 2248 wrote to memory of 2556	2248	2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe	misid.exe
PID 2248 wrote to memory of 2556	2248	2024-05-21_c7370437e1a8f07e8460d6aca0028163_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2556

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
40KB

MD5
9d267df8ed8a59e85493a2e4892487e2

SHA1
d5257e9d2b7ebaa00ad4c999b2c5cb9b3791fac3

SHA256
bb069d37510276d71b6d63232915de3042c6250bc0323b790bf17ffbbb929d9b

SHA512
adbba6f627704ff6ee79a458e0b2b66ceaf062df630c91e372a2349ea7c7c7cd97d0456630bb5ebaa91aff1ae3dd23a602b7af57ab81e5fc9106b06ce84e607f

Download Submit
memory/2248-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2248-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2248-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2248-3-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2556-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2556-24-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2556-23-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download